#apiserver 安装

MASTER_ADDRESS=${1:-"172.19.182.191"}
ETCD_SERVERS=${2:-"https://etcd-1:2379"}
SERVICE_CLUSTER_IP_RANGE=${3:-"10.254.0.0/16"}
ENABLE_ADMISSION_PLUGINS=${4:-"NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction"}

KUBE_SSL_DIR=/etc/kubernetes/ssl
KUBE_CFG_DIR=/opt/kubernetes/cfg

ETCD_SSL_DIR=/opt/etcd/ssl

cat <<EOF >/opt/kubernetes/cfg/kube-apiserver
KUBE_LOGTOSTDERR="true"
KUBE_LOG_LEVEL="4"
KUBE_ETCD_SERVERS="${ETCD_SERVERS}"
KUBE_ETCD_CAFILE="${ETCD_SSL_DIR}/etcd-ca.pem"
KUBE_ETCD_CERTFILE="${ETCD_SSL_DIR}/etcd.pem"
KUBE_ETCD_KEYFILE="${ETCD_SSL_DIR}/etcd-key.pem"
KUBE_API_ADDRESS="0.0.0.0"
KUBE_API_PORT="8080"
NODE_PORT="10250"
KUBE_ADVERTISE_ADDR="${MASTER_ADDRESS}"
KUBE_ALLOW_PRIV="true"
KUBE_SERVICE_ADDRESSES="${SERVICE_CLUSTER_IP_RANGE}"
KUBE_ENABLE_ADMISSION_PLUGINS="${ENABLE_ADMISSION_PLUGINS}"
KUBE_AUTHORIZATION_MODE="RBAC,Node"
#KUBE_ENABLE_BOOTSTRAP_TOKEN_AUTH="--enable-bootstrap-token-auth"
KUBE_TOKEN_AUTH_FILE="${KUBE_CFG_DIR}/token.csv"
KUBE_SERVICE_NODE_PORT_RANGE="30000-50000"
KUBE_API_CLIENT_CA_FILE="${KUBE_SSL_DIR}/ca.pem"
KUBE_API_TLS_CERT_FILE="${KUBE_SSL_DIR}/server.pem"
KUBE_API_TLS_PRIVATE_KEY_FILE="${KUBE_SSL_DIR}/server-key.pem"
KUBE_SERVICE_ACCOUNT_KEY_FILE="${KUBE_SSL_DIR}/ca-key.pem"
KUBE_PROXY_CERT_FILE="${KUBE_SSL_DIR}/client.pem"
KUBE_PROXY_KEY_FILE="${KUBE_SSL_DIR}/client-key.pem"
EOF

cat <<EOF >/usr/lib/systemd/system/kube-apiserver.service
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-apiserver
ExecStart=/opt/kubernetes/bin/kube-apiserver --logtostderr=\${KUBE_LOGTOSTDERR} \\
--v=\${KUBE_LOG_LEVEL} \\
--etcd-servers=\${KUBE_ETCD_SERVERS} \\
--etcd-cafile=\${KUBE_ETCD_CAFILE} \\
--etcd-certfile=\${KUBE_ETCD_CERTFILE} \\
--etcd-keyfile=\${KUBE_ETCD_KEYFILE} \\
--insecure-bind-address=\${KUBE_API_ADDRESS} \\
--insecure-port=\${KUBE_API_PORT} \\
--kubelet-port=\${NODE_PORT} \\
--advertise-address=\${KUBE_ADVERTISE_ADDR} \\
--allow-privileged=\${KUBE_ALLOW_PRIV} \\
--service-cluster-ip-range=\${KUBE_SERVICE_ADDRESSES} \\
--enable-admission-plugins=\${KUBE_ENABLE_ADMISSION_PLUGINS} \\
--authorization-mode=\${KUBE_AUTHORIZATION_MODE} \\
--enable-bootstrap-token-auth \\
--token-auth-file=\${KUBE_TOKEN_AUTH_FILE} \\
--service-node-port-range=\${KUBE_SERVICE_NODE_PORT_RANGE} \\
--client-ca-file=\${KUBE_API_CLIENT_CA_FILE} \\
--tls-cert-file=\${KUBE_API_TLS_CERT_FILE} \\
--tls-private-key-file=\${KUBE_API_TLS_PRIVATE_KEY_FILE} \\
--service-account-key-file=\${KUBE_SERVICE_ACCOUNT_KEY_FILE} \\
--requestheader-client-ca-file=\${KUBE_API_CLIENT_CA_FILE} \\
--requestheader-allowed-names="" \\
--requestheader-extra-headers-prefix=X-Remote-Extra- \\
--requestheader-group-headers=X-Remote-Group \\
--requestheader-username-headers=X-Remote-User 

Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable kube-apiserver
systemctl restart kube-apiserver
systemctl status kube-apiserver

echo -e "\033[42;37m==kube-apiserver配置完成===============================================================================\033[0m"
